Gift Cards, From More Secure to Less Secure

Every year gift cards top many holiday wish lists, but these popular presents are also vulnerable to fraud.
Unlike banks, which spend tens of millions of dollars to thwart credit card fraud, retailers have done far less to safeguard the funds loaded on gift cards. There are also no federal protections for gift card theft like the laws limiting consumer liability for debit or credit card losses.

The result, ValuePenguin has found, is a marketplace where too many gift cards have few to none of the security features that protect consumers against threats that range from simply losing the card to falling victim to criminal enterprises that drain card balances, sometimes before the card is even used.

We examined the security features of 62 physical gift cards from major retailers. (E-gift cards, which are more secure, were not included in the survey, because many holiday shoppers prefer giving a physical card. However, almost all cards listed are available as e-gifts, except those with an asterisk.)

Our most important finding is that many cards lack any protection against theft or loss. Retailers frequently note in the terms and conditions of their gift cards that consumers should “treat gift cards as cash.” That means if you lose one of these cards, or have it stolen from you, the funds are gone and irreplaceable.

More than 45% of the cards we scrutinized offer no theft and loss protection, according to their fine print; we've ranked all these cards towards the bottom of our listing, since we consider them the least secure that we evaluated. Fortunately, though, more than half of the gift cards in our survey (53%, to be precise) offer to protect against loss or theft, which means the issuer should reimburse the amount left on the card should you report it as missing or stolen. However, even if a card comes with loss/theft protection, the burden of proof can be high. You typically must provide documentation—like an original receipt showing the card purchase and any subsequent receipts using the card—before the store will consider replacing any funds. Still, theft protection is better than nothing and we think it’s the single most important security feature a gift card can have.

More Secure Gift Cards

We used three key fraud protection measures to gauge the security of the gift cards we assessed. They are: whether the cards offer loss/theft protection, in the event that you lose the card or it’s stolen; whether they use PINs for security purposes; and whether, if they allow you to check your card balance online, they do so in a way that would thwart an online criminal.

The cards in this group offer all three measures, which makes them the most secure among the 62 cards we examined. While all have a PIN security code—typically a three- or four-digit number found on the back of the card—a PIN alone offers minimal security, because a criminal who steals your card, or someone who simply finds it, will also have its PIN, which is easily found on the back of a card--concealed, at most, by a scratch-off strip.

Further, sophisticated criminals often use automated bots that cycle through combinations of card numbers and PINs on a retailer’s balance check website. When a match is made with a card that has a balance, the fraudsters quickly sell the card information either on gift card exchanges or online black markets. To secure your balance against such fraudsters, the cards below use CAPTCHA technology , which determines whether a user is human or a bot by requiring the completion of a challenge-response test. That can include typing random letters displayed in a box or clicking on squares that complete an image.

Company

Loss/Theft Protection

PIN Available?

Balance-Check Security

American Eagle

Yes

Yes

Yes

Athleta

Yes

Yes

Yes

Banana Republic

Yes

Yes

Yes

Barnes & Noble

Yes

Yes

Yes

BJ's Wholesale Club*

Yes

Yes

Yes

Bloomingdale's*

Yes

Yes

Yes

Dillard's

Yes

Yes

Yes

Dunkin' Donuts

Yes

Yes

Yes

GameStop

Yes

Yes

Yes

Gap

Yes

Yes

Yes

Home Depot

Yes

Yes

Yes

JCPenney

Yes

Yes

Yes

Kmart

Yes

Yes

Yes

Kohl's

Yes

Yes

Yes

Lowe's

Yes

Yes

Yes

Meijer*

Yes

Yes

Yes

Old Navy

Yes

Yes

Yes

Saks Fifth Avenue

Yes

Yes

Yes

Sears

Yes

Yes

Yes

Staples

Yes

Yes

Yes

TJX

Yes

Yes

Yes

Toys "R" Us

Yes

Yes

Yes

Walgreens*

Yes

Yes

Yes

* Not available in an e-gift card format.

Gift Cards That Protect Loss, but Lack Online Security

Next in security, after the cards that have all three key security features we deem important, come this group, which lack only secured balance checks. With these cards, you can obtain their balance without encountering any digital checkpoints, such as those that require you to enter letters or numbers, or identify images, within a CAPTCHA box. That makes them more vulnerable than most cards we examined to having their balances drained by online fraudsters. These criminals could access the balance check feature on the retailer's site, and then use automated bots to cycle through card numbers and PINs until they find your card's balance.

However, like the most secure group above, these cards all offer some recourse if the gift card or card balance is lost or stolen. Many require that you provide the card number, PIN and a copy of the receipt showing the original gift card purchase to recoup any losses.

Company

Loss/Theft Protection

PIN Available?

Balance-Check Security

AMC

Yes

Yes

No

Bass Pro Shop

Yes

Yes

No

Bed Bath & Beyond

Yes

Yes

No

Best Buy

Yes

Yes

No

Dick's Sporting Goods

Yes

Yes

No

Nike

Yes

Yes

No

Nordstrom

Yes

Yes

No

Starbucks

Yes

Yes

No

Target

Yes

Yes

No

Victoria's Secret

Yes

Yes

No

Gift Cards With Online Security, but Few Other Protections

The good news with these two subgroup of cards below is that they make it difficult for criminals to use bots to locate activated gift cards with balances. Like the most secure cards we examined, these mostly do this with CAPTCHA technology that requires a human to enter certain information. However, some others instead require users to sign into an existing account or establish a new account before accessing a gift card's balance. While a fraudster theoretically could create a fake account to run bots on the check balance, these retailers can better track and respond to any suspicious balance-checking activity from a logged account, another strong fraud deterrent.

The bad news about this group is one of these measures is pretty much all the security these cards promise, since they all lack the loss or theft protection that would reimburse your account if you lost the card or had it (or its balance) stolen from you.

IKEA is included because it has no online balance check. While that makes it harder to check how much you have on a card, it also secures the card, since fraudsters have no way to determine if it has been activated or has a balance.

Company

Loss/Theft Protection

PIN Available?

Balance-Check Security

Amazon.com

No

No

Log-in

Apple

No

Yes

Log-in

Brinker

No

No

CAPTCHA

Burlington Coat Factory

No

Yes

CAPTCHA

Darden

No

No

CAPTCHA

eBay

No

Yes

Log-in

Google Play

No

No

Log-in

Ikea

No

No

See above

iTunes

No

Yes

Log-in

J. Crew

No

Yes

CAPTCHA

Michael Kors

No

Yes

CAPTCHA

Neiman Marcus

No

Yes

CAPTCHA

Netflix

No

No

Log-in

Office Depot

No

Yes

CAPTCHA

Ralph Lauren

No

Yes

CAPTCHA

Walmart Stores

No

Yes

CAPTCHA

Less Secure Gift Cards

Like virtually all gift cards on the market, the cards below have a PIN. However, this feature offers only a small security advantage, since the code is easily accessible (on the back of the card) and, unlike the PINs on credit cards, those below cannot be changed tom increase security.

The values that are on the cards in this group also are largely unprotected, according to the card terms and conditions. Lose the card, or have its value stolen by online thieves, and there is no recourse, at least that's promised.

Company

Loss/Theft Protection

PIN Available?

CAPTCHA Required?

Coach

No

Yes

No

Costco*

No

Yes

No

CVS

No

Yes

No

ebay.com

No

Yes

No

Foot Locker

No

Yes

No

Giant Eagle*

No

Yes

No

H&M

No

Yes

No

Kroger*

No

Yes

No

Levi's

No

Yes

No

PetSmart

No

Yes

No

REI

No

Yes

No

Sephora

No

Yes

No

Whole Foods

No

Yes

No

* Not available in an e-gift card format.

Methodology

In a project completed in late November and early December 2017, we surveyed available U.S. gift cards, and settled on detailing security features for 62 cards. Those we selected were from major national retailers. (We skipped so-called “open-loop” gift cards, such as those issued by Visa, MasterCard, American Express and Discover.) For those we included, we reviewed the card’s Terms and Conditions for explicit mention that the card could be replaced in the event that it is stolen or its balance was breached. We also checked cards for whether a Personal Identification Number, or PIN, or other security measures were required in order to use the card. We also visited the websites of the card retailers to verify that the card balances could be checked online. We also noted if either a CAPTCHA box or account log-in was required to complete the balance check.

Advertiser Disclosure: Some of the offers that appear on this website are from companies which ValuePenguin receives compensation. This compensation may impact how and where offers appear on this site (including, for example, the order in which they appear). The site does not review or include all companies or all available products. For more information please see our Advertiser Disclosure.